CVE-2026-24779: 
NixOS vulnerability analysis and mitigation

CVE-2026-24779 is a Server-Side Request Forgery (SSRF) vulnerability in the MediaConnector class of vLLM's multimodal feature set, affecting all versions prior to 0.14.1. The flaw was disclosed on January 27, 2026, and stems from inconsistent URL parsing between Python's urllib and urllib3 libraries used in the load_from_url and load_from_url_async methods. It carries a CVSS v3.1 base score of 7.1 (High) (Github Advisory, GitHub Security Advisory).

The root cause (CWE-918) lies in a URL parsing inconsistency within MediaConnector.load_from_url and its async counterpart: host restriction validation uses Python's urllib.parse.urlparse (RFC 3986-compliant), while the actual HTTP request is dispatched via the requests library, which internally uses urllib3.util.parse_url (WHATWG Living Standard-compliant). These two parsers interpret backslashes (\) in URLs differently, allowing an attacker to craft a URL that passes the allowlist check performed by urlparse but resolves to a different, internal host when fetched by urllib3. Exploitation requires low privileges (authenticated API access) and no user interaction, and is performed over the network (GitHub Security Advisory, vLLM PR #32746).

A successful exploit allows an authenticated attacker to coerce the vLLM server into issuing arbitrary HTTP requests to internal network resources, resulting in high confidentiality impact and low availability impact with no integrity impact. In containerized environments such as llm-d, this could enable internal network scanning, interaction with other pods, and denial of service by falsely reporting metrics (e.g., KV cache state) to internal management endpoints. Sensitive data accessible to the vLLM service account — including cloud metadata endpoints and internal API responses — may be exfiltrated (Github Advisory, Red Hat Bugzilla).

1. Obtain authenticated access: Acquire valid credentials or an API token for the target vLLM instance (low-privilege access is sufficient).
2. Identify multimodal endpoint: Locate the vLLM API endpoint that accepts media URLs (e.g., the multimodal inference endpoint that processes image, audio, or video inputs via URL).
3. Craft a backslash-bypass URL: Construct a URL where the hostname appears to be an allowed external domain when parsed by urllib.parse.urlparse, but resolves to an internal IP or hostname when processed by urllib3. For example, use a URL like http://allowed-domain.com\@internal-host/path, exploiting the differing backslash handling between the two parsers.
4. Submit the malicious request: Send an inference request to the vLLM API with the crafted URL as the media source parameter.
5. Observe SSRF response: The vLLM server fetches the internal resource and may return its contents in an error message or response body, enabling internal network enumeration, metadata service access (e.g., http://169.254.169.254), or interaction with internal management APIs such as llm-d endpoints (GitHub Security Advisory, vLLM PR #32746).

• Network: Outbound HTTP requests from the vLLM pod/server to internal IP ranges (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (e.g., 169.254.169.254); unexpected connections to internal Kubernetes service IPs or pod IPs originating from the vLLM process.
• Logs: vLLM access logs showing multimodal inference requests with URLs containing backslash characters (\) or @ symbols in the hostname portion; HTTP client errors or timeouts referencing internal hostnames in application logs.
• Process: Unusual outbound network connections initiated by the vLLM Python process to non-media, non-CDN destinations; repeated requests to the same internal endpoint in short succession (indicative of port scanning).
• Application Behavior: Unexpected error responses from vLLM containing internal service banners, HTML, or JSON from internal APIs; anomalous KV cache metric reporting in llm-d management dashboards.

Upgrade vLLM to version 0.14.1 or later, which replaces urllib.parse.urlparse with urllib3.util.parse_url uniformly across the codebase, eliminating the parsing inconsistency (GitHub Security Advisory, Patch Commit). As interim mitigations: implement network egress controls (firewall rules or Kubernetes NetworkPolicies) to restrict outbound connections from vLLM pods to only necessary external media domains; restrict API access to trusted, authenticated users only; and monitor outbound traffic from vLLM services for anomalous internal requests. A Red Hat errata (RHSA-2026:3462) is also available for affected Red Hat products (Red Hat Advisory).

Red Hat tracked the vulnerability as high severity in their Bugzilla system and issued a security errata (RHSA-2026:3462) for affected products (Red Hat CVE, Red Hat Advisory). A Medium article on vLLM production security hardening referenced this CVE in the context of enterprise deployment guidance. No significant broader social media controversy or notable independent researcher commentary beyond standard vulnerability tracking was observed.